Skip to content

Floating / Unlocked Pragma

SAFE-0138 Best Practice Checked automatically by the scanner
1

What goes wrong

The pragma uses a caret range (e.g. ^0.8.0) so the contract can be compiled with a different compiler version than it was tested and audited against, potentially pulling in compiler bugs or behaviour changes.

2

The vulnerable pattern

proof of concept — how it is exploited
// audited with 0.8.19 but ^0.8.0 lets someone compile with a version
// carrying a known codegen bug -> deployed bytecode differs from what
// was reviewed.
3

How to fix it

the pattern that is safe
pragma solidity 0.8.24;   // pin the exact reviewed version
Pin an exact compiler version for production.
4

Where this has happened

Largest recorded losses in the same failure class — related, not the same bug:

Check your own contract for this

The SaferICO scanner runs 201 detectors over your Solidity source, SAFE-0138 among them. Paste an address or the source itself — a small per-scan fee, shown before you sign, or unlimited on any plan.

Run the scanner See how it is attacked Read the docs